Ui: >> Unifi Dream Machine Security Vulnerabilities
CVE-2026-34908
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Known exploited
CVSS Score
10.0
EPSS Score
0.025
Published
2026-05-22
CVE-2026-34909
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
Known exploited
CVSS Score
10.0
EPSS Score
0.023
Published
2026-05-22
CVE-2026-34910
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Known exploited
CVSS Score
10.0
EPSS Score
0.786
Published
2026-05-22
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
CVSS Score
7.7
EPSS Score
0.007
Published
2026-05-22
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.
Affected Products:
UDM
UDM-PRO
UDM-SE
UDR
UDW
Mitigation:
Update UniFi Network to Version 7.5.187 or later.
CVSS Score
10.0
EPSS Score
0.006
Published
2023-10-25